Asked by:

Question

One of my users is having problems with EMET 5.1 shutting-down Excel, Outlook, Word, Firefox (43.04), Acrobat Reader (11.0.14) and Chrome (48.0.2564.97). The user gets "EMET detected Caller mitigation and will close the application" just before
shutdown. The system is running 64-bit Windows 7 Enterprise. The user has disabled the Caller check for the affected apps numerous times but the checks become active again after about an hour. I logged into the user's system as an administrator, disabled the
Caller checks and again they become active after about an hour. I also attempted to disable the Caller checks in the registry by
changing the Caller value from 1 to 0 for the various applications in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EMET\_settings_\. These changes also revert back to active Caller checks. I suspect
that the Caller checks are being reactivated by a GPO.

Here is the most recent Excel shutdown and application crash noted in the event viewer. The user had just opened Excel and clicked "File", "Open" and Excel was then shutdown by EMET. Is there any way to stop EMET from continuously doing
this?